Users should be removed from Dynamic Distribution group automatically, when the user attribute is not matching the filter criteria.
To understand the issue better, use PowerShell and see, if the user with un matched attributes are actually exists
$DDG = Get-DynamicDistributionGroup "Dynamic distribution group name"
Get-Recipient -RecipientPreviewFilter $DDG.RecipientFilter